CVE-2023-0153

The CVE-2023-0153 issue affects the WordPress plugin Vimeo Video Autoplay Automute (

WordPress Plugin Vimeo Video Autoplay Automute 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

PT-2023-16042

Name of the Vulnerable Software and Affected Versions Vimeo Video Autoplay Automute WordPress plugin version 1.0 Description The issue concerns a lack of validation and escaping of certain shortcode attributes in the Vimeo Video Autoplay Automute WordPress plugin. This could allow users with the...

CVE-2023-0153: Undefined Security Weakness

The Vimeo Video Autoplay Automute WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

WordPress Vimeo Video Autoplay Automute Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Vimeo Video Autoplay Automute Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0153 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 6b9ac437c259 Credits István...

WordPress GamiPress – Vimeo integration Plugin < 1.0.9 is vulnerable to Cross Site Scripting (XSS)

Software GamiPress – Vimeo integration Type Plugin Vulnerable versions 1.0.9 Fixed in 1.0.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0154 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID eece071753de Credits Lana...

GamiPress – Vimeo integration < 1.0.9 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. gamipressvimeo url='https://vimeo.com/"...

Vimeo Video Autoplay Automute <= 1.0 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. vimeo clipid="1" color="'...

Vimeo Video Autoplay Automute <= 1.0 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC vimeo clipid="1" color="'...

GamiPress – Vimeo integration < 1.0.9 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC gamipressvimeo url='https://vimeo.com/"...

D-Link DIR-825/EE xupnpd Vimeo Plugin Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Vimeo plugin for the xupnpd service, which listens on TCP port...

PT-2022-26992 · D Link · D-Link Dir-825

Name of the Vulnerable Software and Affected Versions: D-Link DIR-825 versions 1.0.9/EE Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the Vimeo...

MAL-2022-704 Malicious code in @vimeo-date-time/relative (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51c1473d4b322bc5f9c72860e45ae3b00ddf07bbc787e6c699729ff45208ab5c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in aframe-vimeo-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72339f974aab0b3963dfa3046690d61a625af2fe12b6b1154f027f80e3901a75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vimeo-threejs-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73ac756c3faaf5d660ad076c8f367c2e70b3c5e8f26198970162b7df50e67866 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vimeo_depth_player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a54fcc7eb6c3b7b858ef789b0478e6e97cc8fe1b20f3a774a4d55742c21bf774 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-888 Malicious code in aframe-vimeo-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72339f974aab0b3963dfa3046690d61a625af2fe12b6b1154f027f80e3901a75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6933 Malicious code in vimeo-threejs-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73ac756c3faaf5d660ad076c8f367c2e70b3c5e8f26198970162b7df50e67866 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress "WordPress YouTube, Vimeo and more elements security Plugin (GDPR)" plugin <= 1.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "WordPress YouTube, Vimeo and more elements security Plugin GDPR" plugin versions = 1.2. Solution No patched version available...

WordPress "WordPress YouTube, Vimeo and more elements security Plugin (GDPR)" plugin <= 1.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress "WordPress YouTube, Vimeo and more elements security Plugin GDPR" plugin versions = 1.2. Solution No patched version available...